If there is an inserted CA then I believe any cert from any website can be MITM'ed and there are appliances that do this. From PaloAltoNetworks website: "...

If there is an inserted CA then I believe any cert from any website can be MITM'ed and there are appliances that do this. From PaloAltoNetworks website: "... firewall proxies outbound SSL connections by intercepting outbound SSL requests and generating a certificate on the fly for the site the user wants to visit."